docs: def api(require_login=True, schema=None, enabled=True,
          require_admin=False, require_anonymous=False):
      """
      Decorator for API requests.
      Handles auth and adds the username as the first argument.
      """
      if require_admin:
          require_login = True
  
      if schema is not None:
          Draft4Validator.check_schema(schema)
          validator = Draft4Validator(schema)
      else:
          validator = None
  
      assert not (require_login and require_anonymous), (
              "Can't both require login and require anonymous access.")
  
      def innerdec(f):
          @wraps(f)
          def wrapper(*args, **kwargs):
              g.auth = Auth(user=None, email=None, is_logged_in=False, is_admin=False, is_active=True)
  
              user_agent_str = request.headers.get('user-agent', '')
              g.user_agent = httpagentparser.detect(user_agent_str, fill_none=True)
  
              if not enabled:
                  raise ApiException(
                      requests.codes.bad_request,
                      "This endpoint is not enabled."
                      )
  
              if validator is not None:
                  try:
                      validator.validate(request.get_json(cache=True))
                  except ValidationError as ex:
                      raise ApiException(requests.codes.bad_request, ex.message)
  
              auth = request.headers.get(AUTHORIZATION_HEADER)
              g.auth_header = auth
              if auth is None:
                  if not require_anonymous:
                      if require_login or not ALLOW_ANONYMOUS_ACCESS:
                          raise ApiException(requests.codes.unauthorized, "Not logged in")
              else:
                  # try to validate new auth
                  token = auth
                  # for compatibility with old clients
                  if token.startswith("Bearer "):
                      token = token[7:]
  
                  try:
                      user = verify_token_string(token)
                  except AuthException:
                      raise ApiException(requests.codes.unauthorized, "Token invalid.")
  
                  g.user = user
                  g.auth = Auth(user=user.name,
                                email=user.email,
                                is_logged_in=True,
                                is_admin=user.is_admin,
                                is_active=user.is_active)
  
                  g.auth_token = token
  
                  if not g.auth.is_active:
                      raise ApiException(
                          requests.codes.forbidden,
                          "Account is inactive. Must have an active account."
                          )
  
              if require_admin and not g.auth.is_admin:
                  raise ApiException(
                      requests.codes.forbidden,
                      "Must be authenticated as an admin to use this endpoint."
                      )
  
              return f(*args, **kwargs)
          return wrapper
      return innerdec